Real Networks Helix Server/Gateway管理服务HTTP POST拒绝服务攻击漏洞

漏洞信息详情

Real Networks Helix Server/Gateway管理服务HTTP POST拒绝服务攻击漏洞

• CNNVD编号：CNNVD-200402-084
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2004-0049
  
• 漏洞类型：
  
  
  未知
  
• 发布时间：
  
  2004-01-14
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-01-05
  
• 厂        商：
  
  realnetworks
• 漏洞来源：
  Matt Moore※ matt@w…

Helix Universal Server是一款由RealNetWorks开发和维护的多类型媒体服务器。
Helix Universal Server/Gateway 9不正确处理部分发送给服务器管理系统端口的HTTP POST消息，远程攻击者可以利用这个漏洞对服务进行拒绝服务攻击。
其中Helix Mobile Server 10也存在同样问题，目前没有详细漏洞细节提供。
攻击者要利用这个漏洞必须能够通过管理界面认证。

厂商补丁：
Real Networks
————-
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Helix Universal Server & Gateway 9

Compaq

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Compaq+Tru64+5.1+%26+5.1A&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Compaq+Tru64+5.1+%26+5.1A&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

FreeBSD

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=FreeBSD+4.0+%26+4.5&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=FreeBSD+4.0+%26+4.5&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

HP UX

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=HP+UX+11.0+%26+11.i&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=HP+UX+11.0+%26+11.i&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

IBM AIX

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=IBM+AIX+4.3+%26+5L&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=IBM+AIX+4.3+%26+5L&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

Linux

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Linux+version+2.4.18&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Linux+version+2.4.18&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

Sun Solaris 2.7

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Sun+Solaris+2.7&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Sun+Solaris+2.7&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

Sun Solaris 2.8

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Sun+Solaris+2.8&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Sun+Solaris+2.8&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

Windows

http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Windows+NT+4.0+%26+2000&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server” target=”_blank”>
http://forms.real.com/rnforms/products/servers/download/download.final.html?platform=Windows+NT+4.0+%26+2000&product=Helix+Universal+Server&program=basic&version=Helix+Universal+Server

Helix Universal Mobile & Gateway 10：

通过在/Plugins目录中用如下文件代替即可：

Solaris 2.8

http://docs.real.com/docs/022604_pluginupdate/solaris/adminfs.so_sunos-58.gz” target=”_blank”>
http://docs.real.com/docs/022604_pluginupdate/solaris/adminfs.so_sunos-58.gz

Linux

http://docs.real.com/docs/022604_pluginupdate/linux/adminfs.so_linux.gz” target=”_blank”>
http://docs.real.com/docs/022604_pluginupdate/linux/adminfs.so_linux.gz

来源: service.real.com
链接:http://service.real.com/help/faq/security/040112_dos/

来源: BID
名称: 9421
链接:http://www.securityfocus.com/bid/9421

来源: service.real.com
链接:http://service.real.com/help/faq/security/security022604.html

来源: BUGTRAQ
名称: 20040318 ptl-2004-02: RealNetworks Helix Server 9 Administration Server Buffer Overflow
链接:http://www.securityfocus.com/archive/1/357834

来源: VULNWATCH
名称: 20040318 ptl-2004-02: RealNetworks Helix Server 9 Administration Server Buffer Overflow
链接:http://seclists.org/lists/vulnwatch/2004/Jan-Mar/0057.html